How to edit my timechart search to show average CPU utilization in 1 minute increments (on chart as well)?

[timmy13]

I'm trying to use the following search...

index=os sourcetype=cpu host=sp3ctxps01  | multikv fields pctIdle  | eval Percent_CPU_Load = 100 - pctIdle  | timechart span=1m avg(Percent_CPU_Load) by host

I'm getting the right data, but the chart appears to be showing the number of events, not the cpu load.

Thanks in advance for pointing out my mistake here.

[woodcock]

The search you gave should be doing exactly as you describe: it will timechart the avg value of field Percent_CPU_Load every minute, PROVIDED field pctIdle is as you imply it to be, which may not be the case. Could it be that you are expecting a single value, not a timeseries? If so, then use this:

 index=os sourcetype=cpu host=sp3ctxps01  | multikv fields pctIdle  | eval Percent_CPU_Load = 100 - pctIdle  | stats avg(Percent_CPU_Load) by host